Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
200
security advisorymoderatememory corruptionSciLinux: SLSA-2016:0491-1 Moderate: Foomatic Memory Issues and Threats
Moderate: foomatic security update. Date: Wed, 23 Mar 2016 16:29:52 -0000 Reply-To: scientific-linux-users@ Sender: Security Errata for Scientific Linux From: Pat Riehecky Subject: Security ERRATA Moderate: foomatic on SL6.x i386/x86_64 MIME-Version: 1.0 Message-ID: Synopsis: Moderate: foomatic security update Advisory ID: SLSA-2016:0491-1 Issue Date: 2016-03-23 CVE Numbers: CVE-2010-5325 CVE-2015-8327 CVE-2015-8560 -- It was discovered that the unhtmlify() function of foomatic-rip did not correctly calculate buffer sizes, possibly leading to a heap-based memory corruption. A malicious attacker could exploit this flaw to cause foomatic-rip to crash or, possibly, execute arbitrary code. (CVE-2010-5325) It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. (CVE-2015-8327, CVE-2015-8560) -- SL6 x86_64 foomatic-4.0.4-5.el6_7.x86_64.rpm foomatic-debuginfo-4.0.4-5.el6_7.x86_64.rpm i386 foomatic-4.0.4-5.el6_7.i686.rpm foomatic-debuginfo-4.0.4-5.el6_7.i686.rpm - Scientific Linux Development Team . A balanced foomatic patch enhances safety by tackling memory overflow and command execution vulnerabilities successfully.. Foomatic Security Update, Memory Corruption, Command Injection, SL6. . Severity: Important. LinuxSecurity.com Team
Mar 23, 2016
•Important
Scientific Linux
98
security advisorysecurity updateRed HatRed Hat 6: RHSA-2016:0491-01 Moderate: Foomatic Memory Corruption
An updated foomatic package that fixes three security issues is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: foomatic security update Advisory ID: RHSA-2016:0491-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2016:0491.html Issue date: 2016-03-22 CVE Names: CVE-2010-5325 CVE-2015-8327 CVE-2015-8560 ==================================================================== 1. Summary: An updated foomatic package that fixes three security issues is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. It was discovered that the unhtmlify() function of foomatic-rip did not correctly calculate buffer sizes, possibly leading to a heap-based memory corruption. A malicious attacker could exploit this flaw to cause foomatic-rip to crash or, possibly, execute arbitrary code. (CVE-2010-5325) It was discovered that foomatic-rip failed to remove all shellspecial characters from inputs used to construct command lines for external programs run by the filter. An attacker could possibly use this flaw to execute arbitrary commands. (CVE-2015-8327, CVE-2015-8560) All foomatic users should upgrade to this updated package, which contains backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1218297 - CVE-2010-5325 foomatic: potential remote arbitrary code execution 1287523 - CVE-2015-8327 cups-filters: foomatic-rip did not consider the back tick as an illegal shell escape character 1291227 - CVE-2015-8560 cups-filters: foomatic-rip did not consider semicolon as illegal shell escape character 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: foomatic-4.0.4-5.el6_7.src.rpm i386: foomatic-4.0.4-5.el6_7.i686.rpm foomatic-debuginfo-4.0.4-5.el6_7.i686.rpm x86_64: foomatic-4.0.4-5.el6_7.x86_64.rpm foomatic-debuginfo-4.0.4-5.el6_7.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: foomatic-4.0.4-5.el6_7.src.rpm x86_64: foomatic-4.0.4-5.el6_7.x86_64.rpm foomatic-debuginfo-4.0.4-5.el6_7.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: foomatic-4.0.4-5.el6_7.src.rpm i386: foomatic-4.0.4-5.el6_7.i686.rpm foomatic-debuginfo-4.0.4-5.el6_7.i686.rpm ppc64: foomatic-4.0.4-5.el6_7.ppc64.rpm foomatic-debuginfo-4.0.4-5.el6_7.ppc64.rpm s390x: foomatic-4.0.4-5.el6_7.s390x.rpm foomatic-debuginfo-4.0.4-5.el6_7.s390x.rpm x86_64: foomatic-4.0.4-5.el6_7.x86_64.rpm foomatic-debuginfo-4.0.4-5.el6_7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: foomatic-4.0.4-5.el6_7.src.rpm i386: foomatic-4.0.4-5.el6_7.i686.rpm foomatic-debuginfo-4.0.4-5.el6_7.i686.rpm x86_64: foomatic-4.0.4-5.el6_7.x86_64.rpm foomatic-debuginfo-4.0.4-5.el6_7.x86_64.rpm These packages are GPG signed byRed Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2010-5325 https://access.redhat.com/security/cve/CVE-2015-8327 https://access.redhat.com/security/cve/CVE-2015-8560 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFW8bgMXlSAg2UNWIIRAku0AKCD+H9IbvXBMQdriz4yycBJ0Cz+/ACfRvzc kzYt9xNP3vTqE/45NtLzP+0=xtkT -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Mar 22, 2016
Red Hat
200
security advisorymoderateupdateScientific Linux: Foomatic Moderate Input Sanitization Issue CVE-2011-2697
Moderate: foomatic security update. Date: Tue, 2 Aug 2011 11:10:22 -0500 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA Moderate: foomatic on SL4.x, SL5.x i386/x86_64 Comments: To: "
Aug 02, 2011
Scientific Linux
200
security advisorysecurity updatearbitrary code executionScientific Linux SL 6.x Foomatic Moderate Input Sanitization Threat CVE-2011-2964
Moderate: foomatic security update. Date: Tue, 2 Aug 2011 10:15:27 -0500 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: FASTBUGS for SL 6.x i386/x86_64 Comments: To: "
Aug 02, 2011
Scientific Linux
98
security advisoryarbitrary code executionRed Hat Enterprise LinuxRed Hat Enterprise Linux 6: RHSA-2011:1110-01 Moderate: Foomatic Input Flaw
An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: foomatic security update Advisory ID: RHSA-2011:1110-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1110.html Issue date: 2011-08-01 CVE Names: CVE-2011-2964 ==================================================================== 1. Summary: An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in C. An input sanitization flaw was found in the foomatic-rip print filter. An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead toarbitrary code execution with the privileges of the "lp" user. (CVE-2011-2964) All foomatic users should upgrade to this updated package, which contains a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 727016 - CVE-2011-2964 foomatic: Improper sanitization of command line option in foomatic-rip (foomatic.c) 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: i386: foomatic-4.0.4-1.el6_1.1.i686.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.i686.rpm x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: i386: foomatic-4.0.4-1.el6_1.1.i686.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.i686.rpm ppc64: foomatic-4.0.4-1.el6_1.1.ppc64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.ppc64.rpm s390x: foomatic-4.0.4-1.el6_1.1.s390x.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.s390x.rpm x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: foomatic-4.0.4-1.el6_1.1.i686.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.i686.rpm x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2011-2964 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . Morecontact details at https://access.redhat.com/security/team/contact Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFONs05XlSAg2UNWIIRAgE/AJsGGKR1uIQ+GzkjlmcfItGwez5r0gCfcE0I sJD4vwC0vmSxKkcT47domB4=OGdu -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Aug 01, 2011
Red Hat
98
security advisorymoderatesecurity updateRed Hat: RHSA-2011-1109-01 Moderate: Foomatic Input Sanitization Risk
An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: foomatic security update Advisory ID: RHSA-2011:1109-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1109.html Issue date: 2011-08-01 CVE Names: CVE-2011-2697 ==================================================================== 1. Summary: An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in Perl. An input sanitization flaw was found in the foomatic-rip print filter. An attacker could submit a print job with the username, title, or job options set to appearas a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the "lp" user. (CVE-2011-2697) All foomatic users should upgrade to this updated package, which contains a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 721001 - CVE-2011-2697 foomatic: Improper sanitization of command line option in foomatic-rip 6. Package List: Red Hat Enterprise Linux AS version 4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm ia64: foomatic-3.0.2-3.2.el4.ia64.rpm foomatic-debuginfo-3.0.2-3.2.el4.ia64.rpm ppc: foomatic-3.0.2-3.2.el4.ppc.rpm foomatic-debuginfo-3.0.2-3.2.el4.ppc.rpm s390: foomatic-3.0.2-3.2.el4.s390.rpm foomatic-debuginfo-3.0.2-3.2.el4.s390.rpm s390x: foomatic-3.0.2-3.2.el4.s390x.rpm foomatic-debuginfo-3.0.2-3.2.el4.s390x.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm ia64: foomatic-3.0.2-3.2.el4.ia64.rpm foomatic-debuginfo-3.0.2-3.2.el4.ia64.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux WS version4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm ia64: foomatic-3.0.2-3.2.el4.ia64.rpm foomatic-debuginfo-3.0.2-3.2.el4.ia64.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: foomatic-3.0.2-38.3.el5_7.1.i386.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.i386.rpm x86_64: foomatic-3.0.2-38.3.el5_7.1.x86_64.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: foomatic-3.0.2-38.3.el5_7.1.i386.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.i386.rpm ia64: foomatic-3.0.2-38.3.el5_7.1.ia64.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.ia64.rpm ppc: foomatic-3.0.2-38.3.el5_7.1.ppc.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.ppc.rpm s390x: foomatic-3.0.2-38.3.el5_7.1.s390x.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.s390x.rpm x86_64: foomatic-3.0.2-38.3.el5_7.1.x86_64.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2011-2697 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFONszpXlSAg2UNWIIRAmE0AJ4q5rI9jCjDajGtFU74G4jiy/uSCwCfTQIF 1DChAaSq+bEwVioJu13GziM=+/8E -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Aug 01, 2011
Red Hat
98
security advisorysecurity updatecode executionRed Hat: RHSA-2011:1110-01 Moderate: Foomatic Code Execution
An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: foomatic security update Advisory ID: RHSA-2011:1110-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1110.html Issue date: 2011-08-01 CVE Names: CVE-2011-2964 ==================================================================== 1. Summary: An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in C. An input sanitization flaw was found in the foomatic-rip print filter. An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the "lp" user. (CVE-2011-2964) All foomatic users should upgradeto this updated package, which contains a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 727016 - CVE-2011-2964 foomatic: Improper sanitization of command line option in foomatic-rip (foomatic.c) 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: i386: foomatic-4.0.4-1.el6_1.1.i686.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.i686.rpm x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: i386: foomatic-4.0.4-1.el6_1.1.i686.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.i686.rpm ppc64: foomatic-4.0.4-1.el6_1.1.ppc64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.ppc64.rpm s390x: foomatic-4.0.4-1.el6_1.1.s390x.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.s390x.rpm x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: foomatic-4.0.4-1.el6_1.1.i686.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.i686.rpm x86_64: foomatic-4.0.4-1.el6_1.1.x86_64.rpm foomatic-debuginfo-4.0.4-1.el6_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2011-2964 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2011 Red Hat, Inc. . Canonical hasissued a significant security patch for the cups package, addressing a major printing vulnerability.. Foomatic Security, Red Hat Enterprise Update, Code Execution Fix. . LinuxSecurity.com Team
Aug 01, 2011
Red Hat
98
security advisorymoderatecode executionRed Hat: RHSA-2011:1109-01 Moderate: Foomatic Print Filter Update
An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: foomatic security update Advisory ID: RHSA-2011:1109-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1109.html Issue date: 2011-08-01 CVE Names: CVE-2011-2697 ==================================================================== 1. Summary: An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in Perl. An input sanitization flaw was found in the foomatic-rip print filter. An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file,rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the "lp" user. (CVE-2011-2697) All foomatic users should upgrade to this updated package, which contains a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 721001 - CVE-2011-2697 foomatic: Improper sanitization of command line option in foomatic-rip 6. Package List: Red Hat Enterprise Linux AS version 4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm ia64: foomatic-3.0.2-3.2.el4.ia64.rpm foomatic-debuginfo-3.0.2-3.2.el4.ia64.rpm ppc: foomatic-3.0.2-3.2.el4.ppc.rpm foomatic-debuginfo-3.0.2-3.2.el4.ppc.rpm s390: foomatic-3.0.2-3.2.el4.s390.rpm foomatic-debuginfo-3.0.2-3.2.el4.s390.rpm s390x: foomatic-3.0.2-3.2.el4.s390x.rpm foomatic-debuginfo-3.0.2-3.2.el4.s390x.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm ia64: foomatic-3.0.2-3.2.el4.ia64.rpm foomatic-debuginfo-3.0.2-3.2.el4.ia64.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux WS version4: Source: i386: foomatic-3.0.2-3.2.el4.i386.rpm foomatic-debuginfo-3.0.2-3.2.el4.i386.rpm ia64: foomatic-3.0.2-3.2.el4.ia64.rpm foomatic-debuginfo-3.0.2-3.2.el4.ia64.rpm x86_64: foomatic-3.0.2-3.2.el4.x86_64.rpm foomatic-debuginfo-3.0.2-3.2.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: foomatic-3.0.2-38.3.el5_7.1.i386.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.i386.rpm x86_64: foomatic-3.0.2-38.3.el5_7.1.x86_64.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: foomatic-3.0.2-38.3.el5_7.1.i386.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.i386.rpm ia64: foomatic-3.0.2-38.3.el5_7.1.ia64.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.ia64.rpm ppc: foomatic-3.0.2-38.3.el5_7.1.ppc.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.ppc.rpm s390x: foomatic-3.0.2-38.3.el5_7.1.s390x.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.s390x.rpm x86_64: foomatic-3.0.2-38.3.el5_7.1.x86_64.rpm foomatic-debuginfo-3.0.2-38.3.el5_7.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2011-2697 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2011 Red Hat, Inc. . Foomatic patch for Red Hat Enterprise Linux resolves an input validation vulnerability rated as medium risk.. Foomatic Update, Red Hat Security, Code Execution Fix, Print Filter Security. . LinuxSecurity.com Team
Aug 01, 2011
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!